[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 provide? (Part 3)

[Assistant]
signed statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications.
Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST publications, other than the ones noted above, are available at http://csrc.nist.gov/publications. ## Abstract

Proceedings of the Cybersecurity in Cyber-Physical Workshop, April 23 - 24, 2012, complete with abstracts and slides from presenters. Some of the cyber-physical systems covered during the first day of the workshop included networked automotive vehicles, networked medical devices, semi-conductor manufacturing, and cyber-physical testbeds. Day two of the workshop covered the electric smart grid. Dr. Farnham Jahanian, NSF, was the keynote speaker on day one. ## Keywords

CPS; cyber-physical systems; cybersecurity; networked automotive vehicles; networked medical devices; semi-conductor manufacturing

## Acknowledgements

The editor would like to thank Suzanne Lightman, Kevin Stine (both NIST), and Mark Enstrom (Neustar) for being reviewers for this document. ## Table of Contents

|   1.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

This implies that threat analysis must consider both the type of threat and the various phases of the supply chain in which the threat is most effective. Moreover, one or more adversaries from different stages of supply chain can collaborate to compromise a hardware, which increases the severity of threats. Such insider threats are called collusion threats [6]. This work proposes a framework for analyzing different threats and how collusion among adversaries can affect the severity of threats. This analysis is divided into five distinct stages that discuss adversaries' intent, access, and resources, and how their collusion affects the severity of different threats. The framework is shown in Fig. 2. The framework incorporates threats across all stages of supply chain including insider threats. - [1] DARPA (2020) DARPA Selects Teams to Increase Security of Semiconductor Supply Chain. Available at https://www.darpa.mil/news/2020/semiconductor-supply-chainsecurity
- [2] DARPA (2021) Expanding Domestic Manufacturing of Secure, Custom Chips for Defense Needs. Available at https://www.darpa.mil/news-events/2021-03-18
- [3] NSWC Crane Corporate Communications (2019) NSWC Crane leverages OTA to ensure that the U.S. Government has access to secure state-of-the-art design, assembly, packaging and test for state-of-the-art microelectronics. Available at https://www.navsea.navy.mil/Media/News/Article/2005099/nswc-crane-leverages-otato-ensure-that-the-us-government-has-access-to-secure/
- [4] Institute for Systems Research (2020) AFRL-Northrop Grumman: Locked Electronics for Assured Design (LEAD): Delay Locking ASIC IP Blocks to Protect Functionality. Available at https://isr.umd.edu/research-funding/afrl-northrop-grumman-locked-electronicsassured-design-lead-delay-locking-asic-ip
- [5] Wolfe F (2020) Aether Spy Next-Generation Multi-Function Radar to Advance, Northrop Grumman Says. Defense Daily .

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Guidelines for Securing Wireless Local Area Networks (WLANs):

3.1.2 Vulnerability Monitoring... 3.1.2 provide more information on these, respectively. 3.1.2 Vulnerability Monitoring

Organizations should do largely the same vulnerability monitoring for WLAN components that they do for any other software: identifying patches and applying them, and verifying security configuration settings and adjusting them as needed (see Section 2).

Guidelines for Securing Wireless Local Area Networks (WLANs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security_ Selected Articles provide? (Part 3)

[Assistant]
echnical group that was sponsored by NIST from 1987 to 1990. The list provides titles, sources, and abstracts of important computer security publications that were relevant to the council's interests.
The National Institute of Standards and Technology (NIST) makes no claim or endorsement of the information provided. However, as this material may be of use to other organizations, NIST is reprinting the articles with permission as part of a continuing effort to assist federal agencies in accordance with NIST's mandate under the Computer Security Act of 1987. Questions regarding this publication should be addressed to National Institute of Standards and Technology, Computer Security Resource Center, A-216 Technology, Gaithersburg, MD 20899. Additional copies of this publication may be purchased through the National Technical Information Service, Springfield, VA 22161, telephone: (703) 487-4650. . Reprinting by permission of UNIXWORLD magazine. Copyright 1990, McGraw-Hill, Inc. ## IS YOUR SYSTEM SAFE? <!-- image -->

worm brought the Internet to its knees, the danger to UNIX networks still exists l · -arly this year, Cornell University graduate student i Robert T. Morris was convicted of creating a rogue fT' computer program - a 'worm' - and releasing it into the Internet. When this issue of UNIXWORLD went to press, Morris was still awaiting sentencing. But the evidence that convicted Morris brought home the stunning impact of the Internet's collapse. In all, the worm temporarily disabled as many as 3000 machines on the network, which links UNIX-based computers at universities, businesses, and military research facilities. By Frank Hayes

<!-- image -->

It took days of intensive work (8000 personnel hours, by one estimate) to isolate the worm and clear it from the Internet. No data was destroyed, but realistic estimates of time lost on the affected machines range as high as $10 million.

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide to Attribute Based Access Control (ABAC) Definition and Considerations provide?

[Assistant]
## NIST Special Publication 800-162

## Guide to Attribute Based Access Control (ABAC) Definition and Considerations

Vincent C. Hu David Ferraiolo Rick Kuhn Adam Schnitzer Kenneth Sandlin Robert Miller Karen Scarfone

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-162

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-162

## Guide to Attribute Based Access Control (ABAC) Definition and Considerations

Vincent C. Hu David Ferraiolo Rick Kuhn Computer Security Division Information Technology Laboratory

Adam Schnitzer Booz Allen Hamilton

Kenneth Sandlin Robert Miller The MITRE Corporation

Karen Scarfone Scarfone Cybersecurity Clifton, VA

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-162

January 2014 INCLUDES UPDATES AS OF 08-02-2019; SEE PAGE IX

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Management Act (FISMA), Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A130, Appendix IV: Analysis of Key Sections . Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources .

Guide to Attribute Based Access Control (ABAC) Definition and Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
| CSF Element              | CSF Element Description                                                                                | Priority   | Recommendations, Considerations, Notes                                                                                |
|--------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| GV.SC-05                 | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties                                                                          | Medium     | R1: Cybersecurity supply chain risk management requirements should include cybersecurity performance and vulnerability, threat, and incident disclosure and information sharing.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

3.2.3 Funds Control Information Type... 3.2.3 Funds Control Information Type

Funds Control includes the management of the Federal budget process including the development of plans and programs, budgets, and performance outputs as well as financing Federal programs and operations through appropriation and apportionment of direct and reimbursable spending authority, fund transfers, investments and other financing mechanisms.

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook:

| ^^ SENSITIVITY/ ^S^RmCALlTY PROTECTION^. CATEGORY   | LEVEL 2 (All level 0 and 1 considerations pius:)                                                                                | LEVELS (All level 0, 1,and 2 considerations plus:)                                                                                |
|-----------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ACCESS CONTROL                                      | Protection measures that allow for: • Identification and authentication of individual users; • Restriction of functional capabilities of individual users; • Users to control access of other individual users to their data and applications; and . Data encryption. | Controls that can at all times restrict and log individual user access by system resource, application, and data files. Authorization to access system resources, appli^tions, and data files must be confirmed by the sponsors/owners (reconfirmation every 6 months). Non-use of encryption justified.

National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to NIST Cloud Computing Forensic Reference Architecture:

n cloud forensics include:
- o The use of obfuscation, malware, data hiding, or other techniques to compromise the integrity of evidence
- o Malware may circumvent virtual machine isolation methods
5.
Incident first responders (e.g., trustworthiness of cloud providers, response time, reconstruction). Incident first responder challenges in cloud forensics include:
- o Confidence, competence, and trustworthiness of the cloud providers to act as first responders and perform data collection
- o Difficulty in performing initial triage
- o Processing a large volume of collected forensic artifacts
6. Role management (e.g., data owners, identity management, users, access control). Role management challenges in cloud forensics include:
- o Uniquely identifying the owner of an account
- o Decoupling between cloud user credentials and physical users
- o Ease of anonymity and creating fictitious identities online
- o Determining exact ownership of data
- o Authentication and access control
7. Legal (e.g., jurisdictions, laws, service-level agreements, contracts, subpoenas, international cooperation, privacy, ethics). Legal challenges in cloud forensics include:
- o Identifying and addressing issues of jurisdictions for legal access to data
- o Lack of effective channels for international communication and cooperation during an investigation
- o Data acquisition that relies on the cooperation, competence, and trustworthiness of cloud providers
- o Missing terms in contracts and service-level agreements
- o Issuing subpoenas without knowledge of the physical location of data
8. Standards (e.g., standard operating procedures, interoperability, testing, validation). Standards challenges in cloud forensics include:
- o Lack of minimum/basic SOPs, practices, and tools
- o Lack of interoperability among cloud providers
- o Lack of test and validation procedures
9. Training (e.g., forensic investigators, cloud providers, qualification, certification).

NIST Cloud Computing Forensic Reference Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Key Performance Indicators for Process Control System Cybersecurity Performance Analysis:

This system employs a modular design which allows a greater flexibility for re-configuration and scalability. The major sub-systems and components are largely independent and have well-defined interfaces, leading to a greater flexibility to change the individual sub-systems, like the continuous manufacturing  process  simulation,  the  network  topologies,  or  the  industrial  communication protocol. This allows the researcher to investigate a wide range of different settings of industrial manufacturing  systems,  and  to  study  the  impacts  of  the  implementation  of  cybersecurity technologies on the system performance and operation.

The Process Control System is initialized in four stages: Stage one is the initialization of application software. In this stage, the OPC DA server, HMI, Data Historian, and the MATLAB Controller are executed and initialized. Stage two is the initialization of the hardware devices. In this stage, the configuration file of the multi-node DeviceNet card and the PLC are loaded and the devices enter run mode waiting for data input. Stage three is the industrial network activation stage. In this stage, the Plant Simulator is activated and all the sensor and actuator nodes are connected to the PLC. The last stage is the simulation start stage. In this stage, the Plant Simulator and Controller are started and all the sub-systems enter run mode.

The Key Performance Indicators (KPI) of the Process Control System are used to measure the performance  of  the  system  and  its  sub-systems.  These  KPIs  are  calculated  in  the  baseline measurement, in which no additional cybersecurity measures are implemented, to form the basis of the performance of the system. In subsequent experiment runs, different cybersecurity measures are implemented and the KPIs are calculated again and compared to the baseline measurement. Analysis can be performed to understand the performance impact caused by the implementation of the cybersecurity measures.

Key Performance Indicators for Process Control System Cybersecurity Performance Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Configuration Management?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1:

| 3 | | | 1.1 | Authority....................................................................................................................3 | | | | 1.2 | Purpose and Scope...................................................................................................3 | | | | 1.3 | Audience ...................................................................................................................4 | | | | 1.4 | Document Structure | ..................................................................................................4 | | | 1.5 | Document Conventions | .............................................................................................4 | | 2.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

- [1] DARPA (2020) DARPA Selects Teams to Increase Security of Semiconductor Supply Chain. Available at https://www.darpa.mil/news/2020/semiconductor-supply-chainsecurity
- [2] DARPA (2021) Expanding Domestic Manufacturing of Secure, Custom Chips for Defense Needs. Available at https://www.darpa.mil/news-events/2021-03-18
- [3] NSWC Crane Corporate Communications (2019) NSWC Crane leverages OTA to ensure that the U.S. Government has access to secure state-of-the-art design, assembly, packaging and test for state-of-the-art microelectronics. Available at https://www.navsea.navy.mil/Media/News/Article/2005099/nswc-crane-leverages-otato-ensure-that-the-us-government-has-access-to-secure/
- [4] Institute for Systems Research (2020) AFRL-Northrop Grumman: Locked Electronics for Assured Design (LEAD): Delay Locking ASIC IP Blocks to Protect Functionality. Available at https://isr.umd.edu/research-funding/afrl-northrop-grumman-locked-electronicsassured-design-lead-delay-locking-asic-ip
- [5] Wolfe F (2020) Aether Spy Next-Generation Multi-Function Radar to Advance, Northrop Grumman Says. Defense Daily . Available at https://www.defensedaily.com/aether-spynext-generation-multi-function-radar-advance-northrop-grumman-says/air-force/
- [6] CISA (2020) Defining Insider Threats. Available at  https://www.cisa.gov/topics/physicalsecurity/insider-threat-mitigation/defining-insider-threats
- [7] Areno M (2020) Supply chain threats against integrated circuits. Intel Whitepaper . Available at https://www.intel.com/content/dam/www/centrallibraries/us/en/documents/2022-08/supply-chain-threats-against-integrated-circuitswhitepaper-july2020.pdf
- [8] Evernex (2024) EOL Meaning: What Does End of Life Mean for Your Hardware? Available at https://evernex.com/industry-guide/eol-meaning/
- [9] Vincent J (2018) Chinese spies reportedly inserted microchips into servers used by Apple, Amazon, and others.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CA.L2-3.12.3 (NIST 3.12.3)?

[Assistant]
According to Digital Identity Guidelines_ Federation and Assertions:

3.12.3. 3.12.3). 3.12.3).

Digital Identity Guidelines_ Federation and Assertions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to Computer Security Log Management:

- GLYPH<c=31,font=/APONEK+Webdings> Antimalware Software. The most common form of antimalware software is antivirus software, which typically records all instances of detected malware, file and system disinfection attempts, and file quarantines. 3 Additionally, antivirus software might also record when malware scans were performed and when antivirus signature or software updates occurred. Antispyware software and other types of antimalware software (e.g., rootkit detectors) are also common sources of security information. - GLYPH<c=31,font=/APONEK+Webdings> Intrusion Detection and Intrusion Prevention Systems. Intrusion detection and intrusion prevention systems record detailed information on suspicious behavior and detected attacks, as well as any actions intrusion prevention systems performed to stop malicious activity in progress. Some intrusion detection systems, such as file integrity checking software, run periodically instead of continuously, so they generate log entries in batches instead of on an ongoing basis. 4
- GLYPH<c=31,font=/APONEK+Webdings> Remote Access Software. Remote access is often granted and secured through virtual private networking (VPN). VPN systems typically log successful and failed login attempts, as well as the dates and times each user connected and disconnected, and the amount of data sent and received in each user session. VPN systems that support granular access control, such as many Secure Sockets Layer (SSL) VPNs, may log detailed information about the use of resources. - GLYPH<c=31,font=/APONEK+Webdings> Web Proxies. Web proxies are intermediate hosts through which Web sites are accessed. Web proxies make Web page requests on behalf of users, and they cache copies of retrieved Web pages to make additional accesses to those pages more efficient. Web proxies can also be used to restrict Web access and to add a layer of protection between Web clients and Web servers.

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Guide to Intrusion Detection and Prevention Systems (IDPS):

3.1.1                                                                                | Typical Components... 3.1.1 Typical Components

The typical components in an IDPS solution are as follows:

- GLYPH<c=31,font=/HHCKCL+Webdings> Sensor or Agent. 3.1.1 through 3.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) provide? (Part 4)

[Assistant]
-85A, contains the test assertions and test procedures for testing smart card middleware as well as the card application. The tests reflect the design goals of interoperability and PIV Card functions.
## Keywords

application programming interface (API); authentication; card command interface; derived test requirements (DTR); FIPS 201; identity credential; middleware; Personal Identity Verification (PIV); smart cards; test assertions

## Acknowledgements

The authors (David Cooper, Hildegard Ferraiolo Ramaswamy Chandramouli of NIST, and Jason Mohler of Electrosoft Services, Inc.) wish to thank their colleagues who reviewed drafts of this document and contributed to its development. The authors also gratefully acknowledge and appreciate the many contributions from the public and private sectors whose thoughtful and constructive comments improved the quality and accuracy of this publication. ## ALIGNING REVISION NUMBERS

WHAT HAPPENED TO SPECIAL PUBLICATION 800-85A REVISION 3 (SP 800-85A-3)? Revision numbers between NIST Special Publications 800-73 and 800-85A were misaligned from the start because the initial publication of SP 800-85A did not occur until after the publication of SP 800-73 Revision 1 (SP 800-73-1). This resulted in versions of the two documents corresponding as follows:  SP 800-73-1 with SP 800-85A; SP 800-73-2 with SP 80085A-1 (i.e., Revision 1); and SP 800-73-3 with SP 800-85A-2. This revision numbering mismatch created ongoing uncertainty and confusion regarding which revision of SP 800-85A was consistent with which revision of SP 800-73. To reduce this uncertainty going forward, revision number 3 has been skipped for SP 800-85A, and the present version of SP 800-85A has been given revision number 4 (SP 800-85A-4) since this version is consistent with the updates to SP 800-73 Revision 4 (SP 800-73-4). Future revisions of SPs 80073 and 800-85A will maintain the revision number consistency. ## Table of Contents

| 1.

PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guidelines for Securing Wireless Local Area Networks (WLANs):

Organizations with WLANs should also have the capability to identify the physical location of a detected WLAN threat by using triangulation-estimating the threat's approximate distance from multiple sensors by the strength of the threat's signal received by each sensor, then calculating the physical location at which the threat would be the estimated distance from each sensor. This allows an organization to send appropriate personnel, such as physical security staff, to the location to address the threat.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does ISCMA_ An Information Security Continuous Monitoring Program Assessment provide?

[Assistant]
## NISTIR 8212

## ISCMA: An Information Security Continuous Monitoring Program Assessment

Kelley Dempsey Victoria Pillitteri Chad Baer Ron Rudman

Robert Niemeyer

Susan Urban

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8212

<!-- image -->

## NISTIR 8212

## ISCMA: An Information Security Continuous Monitoring Program Assessment

## Kelley Dempsey Victoria Pillitteri

Computer Security Division Information Technology Laboratory

## Chad Baer

Cybersecurity and Infrastructure Security Agency U.S. Department of Homeland Security

Ron Rudman Robert Niemeyer Susan Urban The MITRE Corporation

McLean, VA

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8212

March 2021

<!-- image -->

U.S. Department of Commerce

Gina Raimondo, Secretary

## National Institute of Standards and Technology

James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.

ISCMA_ An Information Security Continuous Monitoring Program Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards:

The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards [NERC CIP] are a set of requirements designed to mitigate the risk of a compromise that could lead to misoperation or instability in the Bulk Electric System (BES). The scope of the CIP Cyber Security Standards is restricted to BES Cyber Systems that would impact the reliable operation of the BES. The Reliability Standards cover topics like the identification and protection of BES Cyber Assets, defining logical isolation perimeters, personnel and training, BES Cyber System security management, disaster recovery planning, physical security, and supply chain risk management. | Function   | Category Unique Identifier   | Category                               |
|------------|------------------------------|----------------------------------------|
| Identify   | ID. AM                       | Asset Management                       |
| Identify   | ID. BE                       | Business Environment                   |
| Identify   | ID.

Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.2.2 rsakpg2-prime-factor ... 3.2.2 rsakpg2-prime-factor

rsakpg2-prime-factor is the generator in the RSAKPG2 family such that the private key is in the prime-factor format ( p , q , d ). 3.2.2).

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Computer Security Division 2005 Annual Report:

onal-level personnel. We also invite public and private organizations to submit their information security practices to be considered for inclusion on the list of practices maintained on the Web site.
Policies and procedures may be submitted to us in any area of information security, including accreditation, audit trails, authorization of processing, budget planning and justification, certification, contingency planning, data integrity, disaster planning, documentation, hardware and system maintenance, identification and authentication, incident  handling  and  response, life cycle, network  security, personnel  security, physical and environmental protection, production

Computer Security Division 2005 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Cryptographic Algorithms and Key Sizes for Personal Identity Verification provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-78-5

## Cryptographic Algorithms and Key Sizes for Personal Identity Verification

Hildegard Ferraiolo Andrew Regenscheid

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-78-5

<!-- image -->

## NIST Special Publication 800 NIST SP 800-78-5

## Cryptographic Algorithms and Key Sizes for Personal Identity Verification

Hildegard Ferraiolo Andrew Regenscheid

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-78-5

July 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Cryptographic Algorithms and Key Sizes for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Anonymous Consumer Goods Company:

The maturity of the Consumer Goods Company's cybersecurity and supply chain risk posture is driven by a combination of internal and external expertise. Third-party assessments are an important tool to capture relevant cyber risks and identify appropriate mitigations. The Consumer Goods Company engages cybersecurity and supply chain risk consultants to evaluate and stress test existing processes and controls. Each year, third-party assessments include compliance audits, penetration tests, strategic planning, and tabletop exercises. Tabletop exercises are dynamic simulations of a complex incident with representative stakeholders from every impacted domain, including CISO organization, commercial sourcing, legal, and executive leadership. These simulations have identified a number of opportunities to improve capabilities and processes, and the company intends to include representatives from critical suppliers in future exercises.

Case Studies in Cyber Supply Chain Risk Management_ Anonymous Consumer Goods Company


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cybersecurity Framework Profile for Liquefied Natural Gas:

..............................................................................47                                                                                |
| Appendix A.
| List of Symbols, Abbreviations, and Acronyms............................................ | 49                                                                                |
| Appendix B. | Glossary.............................................................................................................50                                                                                |                                                                                |
| Appendix C. | Change Log........................................................................................................

Cybersecurity Framework Profile for Liquefied Natural Gas


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

3.4.2                                                                                | Intrusion Prevention Systems... 3.4.2 Intrusion Prevention Systems

Network-based intrusion prevention systems (IPS) perform packet sniffing and analyze network traffic to identify and stop suspicious activity.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

3.4.2 Inventory Control Information Type... 3.4.2 Inventory Control Information Type

Inventory control refers to the tracking of information related to procured assets and resources with regards to quantity, quality, and location.

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation provide? (Part 4)

[Assistant]
l comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

FIPS 201 defines the requirements and characteristics of government-wide interoperable identity credentials.
It specifies that these identity credentials must be stored on a smart card and that additional common identity credentials, known as derived PIV credentials, may be issued by a federal department or agency and used when a PIV Card is not practical. This document contains the technical specifications to interface with the smart card to retrieve and use PIV identity credentials. The specifications reflect the design goals of interoperability and PIV Card functions. The goals are addressed by specifying a PIV data model, card edge interface, and application programming interface. Moreover, this document enumerates requirements for the options and branches in international integrated circuit card standards. The specifications go further by constraining interpretations of the normative standards to ease implementation, facilitate interoperability, and ensure performance in a manner tailored for PIV applications. ## Keywords

authentication; FIPS 201; identity credential; logical access control; on-card biometric comparison; Personal Identity Verification (PIV); physical access control; smart cards; secure messaging. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Security Property Verification by Transition Model:

The author would like to express his thanks to Isabel Van Wyk and Jim Foti of NIST and Antonios Gouglidis of School of Computing and Communications Lancaster University for their detailed editorial review of both the public comment version and the final publication. Conference on Computer and Communications Security (CCS '11) (ACM, Chicago, IL) , pp . 163-174. https://dl.acm.org/doi/10.1145/2046707.2046727 [NU] Fondazione Bruno Kessler (2023) NuSMV: a new symbolic model checker. Available at https://nusmv.fbk.eu/ [NX] NetwokX developers (2024) NetworkX: Network Analysis in Python. Available at https://networkx.org/ [SF] NPTEL (2015) Safety properties described by automata. Available at https://www.youtube.com/watch?v=DzbqwlUw2-g [SP] Spin developers (2024) Verifying Multi-threaded Software with Spin. Available at https://spinroot.com/spin/whatispin.html [SP162] Hu VC, Ferraiolo DF, Kuhn DR, Schnitzer A, Sandlin K, Miller R, Scarfone KA (2014) Guide to Attribute Based Access Control (ABAC) Definition and Considerations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-162, Includes updates as of August 02, 2019. https://doi.org/10.6028/NIST.SP.800-162 [SP192] Hu VC, Kuhn DR, Yaga D (2017) Verification and Test Methods for Access Control Policies/Models. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-192. https://doi.org/10.6028/NIST.SP.800-192 [WP] Wikipedia (2024) Dining philosophers problem . Available at https://en.wikipedia.org/wiki/Dining\_philosophers\_problem [XA] OASIS Open (2023) XACML resources. Available at http://docs.oasis-open.org/xacml/ [YC] CTL* (2016) NPTEL National Program on Technology Enhanced learning . Available at https://www.youtube.com/watch?v=\_2E5Q3CZ7g4&t=56s [YC2] CTL (2016) National Program on Technology Enhanced learning .

Security Property Verification by Transition Model


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automation Support for Security Control Assessments_ Software Asset Management provide? (Part 3)

[Assistant]
security capability, adding tangible detail to the more general overview given in NISTIR 8011 Volume 1, and providing a template for transition to a detailed, NIST guidance-based automated assessment.
This document, Volume 3 of NISTIR 8011, addresses the Software Asset Management (SWAM) information security capability. The focus of the SWAM capability is to manage risk created by unmanaged or unauthorized software on a network. Unmanaged or unauthorized software is a target that attackers can use as a platform from which to attack components on the network. ## Keywords

actual state; assessment; authorization boundary; automation; capability; continuous diagnostics and mitigation; dashboard; defect; desired state specification; firmware; information security continuous monitoring; ISCM; inventory management; malicious code; malware; mitigation; mobile code; ongoing assessment; root cause analysis; security capability; security control; security control item; software; software asset management; software file; SWID tag; whitelisting. ## Acknowledgments

The authors, Kelley Dempsey and Ned Goren of the National Institute of Standards and Technology (NIST), Paul Eavy of the Department of Homeland Security, and Dr. George Moore of the Applied Physics Laboratory at Johns Hopkins University, wish to thank their colleagues who reviewed drafts of this document and provided valuable input, including Nathan Aileo, Ujwala Arikatla, Mark Bunn, Jim Foti, John Groenveld, Susan Hansche, Blair Heiserman, Frank Husson, Mike Ko, Alan McClelland, Susan Pagan, David Waltermire, and Kimberly Watson . The authors also gratefully acknowledge and appreciate the comments and contributions made by government agencies, private organizations, and individuals in providing direction and assistance in the development of this document. ## Table of Contents

| Executive Summary...................................................................................................................

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

NISTIR 8183 Revision 1 updates the Manufacturing Profile to include the sub-category enhancements established in NIST Framework for Improving Critical Infrastructure Cybersecurity Version 1.1. These updates include managing cybersecurity within the supply chain, self-assessing cybersecurity risk, vulnerability disclosure, system integrity, and more comprehensive controls for identity management.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective provide? (Part 4)

[Assistant]
| Why is conformity assessment for cybersecurity standards important?
....................................3                                                |
| 3                                                                                | Core Areas in Cybersecurity Standardization ............................................................................4                                |
| 4                                                                                | Some Key IT Applications ..........................................................................................................6                     |
| 5                                                                                | Present State of International Cybersecurity Standardization ...................................................7                                        |
| 6                                                                                | Standards Developing Organizations (SDOs) ...........................................................................

Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to IPsec VPNs:

Looking at the SAD and SPD entries of the previous figures, it can be seen that the host with IP address 198.51.100.1 is allowed to send ESP packets to the host with IP 203.0.113.1. The encrypted IP packet included can only have the source IP address 192.168.13.6 but can have any destination IP address. AES-GCM is used as the AEAD encryption algorithm. In other words, there is a VPN client running on 198.51.100.1 that started a VPN connection to the VPN server on 203.0.113.1 and received the internal IP address 192.168.13.6.

Other decisions should also be made during the design phase, such as setting IKE and IPsec SA lifetimes and identifying which DH group number is best. In addition to meeting the organization's cryptographic requirements of NIST SP 800-131A [18] and FIPS 140 [13][14], design decisions should incorporate the organization's logging and data management strategies, incident response and recovery plans, resource replication and failover needs, and current and future network characteristics, such as the use of wireless, NAT, and IPv6. Section 7.2.6 covers these considerations and design decisions in more detail.

For endpoints outside of the organization's control-such as systems belonging to business partners, users' home computers, and public internet access networks-organizations should recognize that some of the endpoints might violate the organization's minimum security standards. For example, some of these external endpoints might be compromised by malware and other threats; malicious activity could then enter the organization's networks from the endpoints through their IPsec connections. To minimize risk, organizations should restrict the access provided to external endpoints as much as possible and also ensure that policies, processes, and technologies are in place to detect and respond to suspicious activity. Organizations should be prepared to identify users or endpoint devices of interest and disable their IPsec access rapidly as needed.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

ne or more information systems. If an information system inherits a common control, such as environmental controls within a data center, that system does not need to explicitly implement that control.
- Applying scoping considerations - these, when applied in conjunction with risk management guidance, can eliminate unnecessary security controls from the initial security control baselines and help ensure that organizations select only those controls needed to provide the appropriate level of protection for information systems. When scoping considerations are applied, compensating controls may need to be selected to provide alternative means to achieve security requirements. - Supplementing baselines - additional security controls and control enhancements are selected if needed to address specific threats and vulnerabilities.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.7 (NIST 3.2.7)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

3.2.7) • Added ECDH key agreement scheme (SP 800-73-5 Part 2, Sec.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

| Scope.........................................................................................................................
| 3                                                                                |
|                                                                                | Audience                                                                                | .................................................................................................................... 3               |
|                                                                                | Document Structure.................................................................................................... | 3                                                                                |
|                                                                                | Document Conventions                                                                                | .............................................................................................. 4                                     |
| Overview of Mobile Devices ............................................................................................ | Overview of Mobile Devices ............................................................................................

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis provide? (Part 3)

[Assistant] ii | | 1 | Introduction.......................................................................................................................................1 | | 2 | Robotic Enclave .................................................................................................................................1 | | 2.1 | Server Operations .......................................................................................................................2 | | 2.2 | Emulated Manufacturing Operation...........................................................................................3 | | 2.3 | Network Architecture .................................................................................................................3 | | 2.4 | Process Operations and Data Flow.............................................................................................5 | | 3 | Metrics and KPI..................................................................................................................................6 | | 3.1 | Terminology ................................................................................................................................7 | | 3.2 | Selection Process ........................................................................................................................7 | | 4 | Measurement Methodologies...........................................................................................................7 | | 4.1 | Manufacturing process Performance .........................................................................................8 | | 4.2 | Robot Performance.....................................................................................................................9 | | 4.3 | Network Performance...............................................................................................................10 | | 4.4 | Programmable Logic Controller Performance..........................................................................11 | | 4.5 | Server Performance ..................................................................................................................11 | | 5 | Appendix A - Description of Measurements and KPI......................................................................13 | | 6 | Appendix B - References.................................................................................................................39 | | LIST OF FIGURES | |-------------------------------------------------------------------------------------------------------------------------------------------------| | Figure 1 - View of the robotic enclave and its components...................................................................2 | | Figure 2 - Flow chart of the emulated manufacturing process..............................................................3 | | Figure 3 - Diagram of the network architecture and its components....................................................4 | | Figure 4 - Data flow diagram..................................................................................................................5 | | LIST OF TABLES | |-----------------------------------------------------------------------------------------------------------------------------------------------| | Table 1 - Manufacturing Process Metrics...............................................................................................8 | | Table 2 - Manufacturing Process KPI......................................................................................................8 | |

Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Security Segmentation in a Small Manufacturing Environment support CMMC certification?

[Assistant]
According to Security Segmentation in a Small Manufacturing Environment:

ve (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Manufacturers are increasingly targeted in cyber-attacks.
Small manufacturers are particularly vulnerable due to limitations in staff and resources to operate facilities and manage cybersecurity. Security segmentation is a cost-effective and efficient security design approach for protecting cyber assets by grouping them based on both their communication and security requirements. This paper outlines a six-step approach that manufacturers can follow to implement security segmentation and mitigate cyber vulnerabilities in their manufacturing environments. The security architecture resulting from the security segmentation design activities is a foundational preparation step for additional security strategies like Zero Trust. ## Keywords

Assets; cyber risk mitigation; industrial control systems; manufacturing; security architecture; security controls; security requirements; security segmentation; security strategy. ## Audience

The intended audience is managers of information technology and operational technology (IT/OT) systems at small manufacturing organizations. This may include roles of company owner, operations manager, and, if technical resources are present, network and security architect or even the Chief Information Officer/Chief Information Security Officer (CIO/CISO). This paper is intended for those who are interested in implementing a cost-effective and efficient mitigation for cyber vulnerabilities in small manufacturing environments.

Security Segmentation in a Small Manufacturing Environment

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide to Operational Technology (OT) Security:

This document is the third revision of NIST SP 800-82. Updates in this revision include:

•  Updates to OT threats and vulnerabilities

•  Updates to OT risk management, recommended practices, and architectures

Guide to Operational Technology (OT) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3:

3.5.1] with the following changes:

1.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

This publication provides a catalog of security and privacy controls for information systems and
organizations to protect organizational operations and assets, individuals, other organizations,
and the Nation from a diverse set of threats and risks, including hostile attacks, human errors,
natural disasters, structural failures, foreign intelligence entities, and privacy risks. The controls
are flexible and customizable and implemented as part of an organization-wide process to
manage risk. The controls address diverse requirements derived from mission and business
needs, laws, executive orders, directives, regulations, policies, standards, and guidelines. Finally,
the consolidated control catalog addresses security and privacy from a functionality perspective
(i.e., the strength of functions and mechanisms provided by the controls) and from an assurance
perspective (i.e., the measure of confidence in the security or privacy capability provided by the
controls). Addressing functionality and assurance helps to ensure that information technology
products and the systems that rely on those products are sufficiently trustworthy. Organizations must exercise due diligence in managing information security and privacy risk. This
is accomplished, in part, by establishing a comprehensive risk management program that uses
the flexibility inherent in NIST publications to categorize systems, select and implement security
and  privacy  controls  that  meet  mission  and  business  needs,  assess  the  effectiveness  of  the
controls, authorize the systems for operation, and continuously monitor the systems. Exercising
due diligence and implementing robust and comprehensive information security and privacy risk
management  programs  can  facilitate  compliance  with  applicable  laws,  regulations,  executive
orders,  and  governmentwide  policies.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines on Firewalls and Firewall Policy:

The authors also wish to express their thanks to the individuals and organizations that contributed to the original version of the publication, including John Wack of NIST and Ken Cutler and Jamie Pole of the MIS Training Institute, who authored the original version, and other contributors and reviewersparticularly Peter Batista and Wayne Bavry (U.S. Treasury); Harriet Feldman (Integrated Computer Engineering, Inc.); Rex Sanders (U.S. Geological Survey); and Timothy Grance, D. Richard Kuhn, Peter Mell, Gale Richter, and Murugiah Souppaya (NIST). Stateful inspection improves on the functions of packet filters by tracking the state of connections and blocking packets that deviate from the expected state. This is accomplished by incorporating greater awareness of the transport layer. As with packet filtering, stateful inspection intercepts packets at the network layer and inspects them to see if they are permitted by an existing firewall rule, but unlike packet filtering, stateful inspection keeps track of each connection in a state table. While the details of state table entries vary by firewall product, they typically include source IP address, destination IP address, port numbers, and connection state information. Firewalls with application-proxy gateways can also have several disadvantages when compared to packet filtering and stateful inspection. First, because of the 'full packet awareness' of application-proxy gateways, the firewall spends much more time reading and interpreting each packet. Because of this, some of these gateways are poorly suited to high-bandwidth or real-time applications-but applicationproxy gateways rated for high bandwidth are available. To reduce the load on the firewall, a dedicated proxy server (discussed in Section 2.1.5) can be used to secure less time-sensitive services such as email and most web traffic.

Guidelines on Firewalls and Firewall Policy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 1?

[Assistant]
According to Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”:

ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-05-06

## How to Cite this NIST Technical Series Publication

Megas, K, Fagan M, Cuthill B, Hoehn B , Petrella E (2025) Workshop Summary Report for 'Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers' . (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8572. https://doi.org/10.6028/NIST.IR.8572

## Author ORCID iDs

Katerina Megas: 0000-0002-2815-5448

Michael Fagan: 0000-0002-1861-2609

Barbara Cuthill: 0000-0002-2588-6165

## Contact Information

iotsecurity@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8572/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This report summarizes discussions held at the March 5, 2025 "Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers' organized by the NIST Cybersecurity for the Internet of Things (IoT) program.

Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

A software development life cycle (SDLC) 1 is a formal or informal methodology for designing, creating, and maintaining software (including code built into hardware). There are many models for SDLCs, including waterfall, spiral, agile, and - in particular - agile combined with software development and IT operations (DevOps) practices. Few SDLC models explicitly address software security in detail, so secure software development practices usually need to be added to and integrated into each SDLC model. Regardless of which SDLC model is used, secure software development practices should be integrated throughout it for three reasons: to reduce the number of vulnerabilities in released software, to reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and to address the root causes of vulnerabilities to prevent recurrences. Vulnerabilities include not just bugs caused by coding flaws, but also weaknesses caused by security configuration settings, incorrect trust assumptions, and outdated risk analysis.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Module-Lattice-Based Digital Signature Standard provide? (Part 2)

[Assistant]
gainst adversaries in possession of a large-scale quantum computer. Keywords: cryptography; digital signatures; Federal Information Processing Standards; lattice; postquantum; public-key cryptography.
## Federal Information Processing Standards Publication 204

Published:

August 13, 2024

Effective:

August 13, 2024

## Announcing the Module-Lattice-Based

## Digital Signature Standard

Federal Information Processing Standards (FIPS) publications are developed by the National Institute of Standards and Technology (NIST) under 15 U.S.C. 278g-3 and issued by the Secretary of Commerce under 40 U.S.C. 11331. 1. Name of Standard. Module-Lattice-Based Digital Signature Standard (FIPS 204). 2. Category of Standard. Computer Security. Subcategory. Cryptography. 3. Explanation. This standard specifies ML-DSA, a lattice-based digital signature algorithm for applications that require a digital signature rather than a written signature. Additional digital signature schemes are specified and approved in other NIST Special Publications and FIPS publications (e.g., FIPS 186-5 [1]). A digital signature is represented in a computer as a string of bits and computed using a set of rules and parameters that allow the identity of the signatory and the integrity of the data to be verified. Digital signatures may be generated on both stored and transmitted data. Signature generation uses a private key to generate a digital signature. Signature verification uses a public key that corresponds to but is not the same as the private key. Each signatory possesses a key-pair composed of a private key and a corresponding public key. Public keys may be known by the public, but private keys must be kept secret. Anyone can verify the signature by employing the signatory's public key. Only the user who possesses the private key can generate a signature that can be verified by the corresponding public key. The digital signature is provided to the intended verifier along with the signed data.

Module-Lattice-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

Support for Streamlined SCAP Content Creation, Acquisition, and Reuse: SCAP v2 will develop and incorporate simpler formats for use in content creation, including updates to the Extensible Configuration Checklist Description Format (XCCDF) and the

Open Vulnerability and Assessment Language (OVAL), and will develop ways to use system artifacts in posture assessments that do not require deep system expertise. Additionally, by using standardized interfaces and protocols to discover and retrieve SCAP content, SCAP v2 products will be able to detect when new SCAP content is available and automatically acquire suitable content updates based on organizational policies. These same interfaces can be used to discover content for reuse. - Posture Evaluator Protocol : To support the separation of collection and evaluation, SCAP v2 will need to define a remote evaluation protocol to enable Posture Evaluators to be plugged into the architecture. This protocol will need to define how to request an evaluation and how a Posture Evaluator can request Endpoint posture to be collected from a Posture Collection Server. - XCCDF Language Improvements: XCCDF currently uses the CPE Applicability language. XCCDF [18] needs to be updated to support the Endpoint Applicability Language and SWID tags. There are also several extensibility enhancements requested by the SCAP community that need to be addressed. These updates are expected to be worked in an international standards organization. - OVAL-Based Collection and Language Improvements: A messaging model is needed to allow for the collection of configuration setting information from an endpoint using OVAL [19]. A NEA extension will be developed to allow for event-driven and ad-hoc OVAL-based collection of configuration setting information.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to NIST Cloud Computing Forensic Reference Architecture:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. This publication was developed by the NIST Cloud Computing Forensic Science Working Group (NCC FSWG) co-chaired by Dr. Martin Herman and Dr. Michaela Iorga. NIST and the co-chairs wish to gratefully acknowledge and thank the members whose dedicated efforts contributed significantly to researching this topic and to generating the data included in this publication, which constitutes the foundation of NIST's Cloud Computing Forensic Reference Architecture.

NIST Cloud Computing Forensic Reference Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters provide? (Part 5)

[Assistant]
s may be out of scope for CAVP or CMVP validation testing and are thus the responsibility of entities using, implementing, installing, or configuring applications that incorporate this Recommendation.
Conformant implementations may perform procedures via an equivalent sequence of operations, provided that these include all cryptographic checks included with the specifications in this document. This is important because the checks are essential for the prevention of subtle attacks. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guidelines on Active Content and Mobile Code:

Responding to computer security incidents effectively necessitates a significant amount of preparation. Incident response activities require technical knowledge as well as effective communication and coordination among personnel who respond to the incident, to return the system as quickly as possible to normal operations.  Proper periodic backup of critical files is a key ingredient in recovering from the adverse effects of an incident.  NIST SP 800-61, Computer Security Incident Handling Guide [NIST04] provides an overview of the processes necessary for organizations to develop effective incident handling programs and policies.

Guidelines on Active Content and Mobile Code


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Threat Assessment of Malicious Code and External Attacks:

Today, desktop workstations are becoming the tool of more and more scientists and professionals. Without proper time and training to administer these systems, vulnerability to both internal and external attacks will increase. Workstations are usually administered by individuals whose primary job description is not the administration of the workstation. The workstation is merely a tool to assist in the performance of the actual job tasks. As a result, if the workstation is up and running, the individual is satisfied.

Of course, even with proper training and adequate tools threats will remain. New security bugs and attack mechanisms will be employed. Proper channels do not currently exist in most organizations for the dissemination of security related information. If organizations do not place a high enough priority on computer security, the average system will continue to be at risk from external threats.

Poor administrative practices and the lack of education, tools, and controls combine to leave the average system vulnerable to attack. Research promises to alleviate the inadequate supply of tools and applicable controls. These controls, however, tend to be add-on controls. There is a need for the delivery of secure systems, rather than the ability to build one from parts. The average administrator has little inclination to perform these modifications, and no idea how to perform them.

Threat Assessment of Malicious Code and External Attacks


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system. Malware is the most common external threat to most hosts, causing widespread damage and disruption and necessitating extensive recovery efforts within most organizations. This publication provides recommendations for improving an organization's malware incident prevention measures. It also gives extensive recommendations for enhancing an organization's existing incident response capability so that it is better prepared to handle malware incidents, particularly widespread ones. Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system. Malware is the most common external threat to most hosts, causing widespread damage and disruption and necessitating extensive recovery efforts within most organizations. Organizations also face similar threats from a few forms of non-malware threats that are often associated with malware. One of these forms that has become commonplace is phishing, which is using deceptive computer-based means to trick individuals into disclosing sensitive information. Organizations should perform threat mitigation to detect and stop malware before it can affect its targets. The most commonly used malware threat mitigation technical control is antivirus software; organizations should deploy antivirus software on all hosts for which satisfactory antivirus software is available.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommended Cybersecurity Requirements for Consumer-Grade Router Products:

mer -grade router' is a router intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems.
T hroughout this document, the term 'router' is used as a shorthand for 'consumer -grade router.' As technology advances, the need for robust router cybersecurity becomes ever more critical to maintain a safe and trustworthy digital environment.

Recommended Cybersecurity Requirements for Consumer-Grade Router Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Mobile Forensic Reference Materials_ a Methodology and Reification provide? (Part 3)

[Assistant]
----------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
| 2.
| Background ...........................................................................................................................2      | Background ...........................................................................................................................2     |
| 3. | Forensic Reference Material .................................................................................................3               | Forensic Reference Material .................................................................................................3              |
| 4. | Identity Modules ....................................................................................................................4       | Identity Modules ....................................................................................................................4      |
| 4.1 File System Organization                                                                                | 4.1 File System Organization                                                                                | ...............................................................................................4                                            |
| 4.2 Data Coverage                                                                                | 4.2 Data Coverage                                                                                | ...............................................................................................................5                            |
| 5.

Mobile Forensic Reference Materials_ a Methodology and Reification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Assessing Security Requirements for Controlled Unclassified Information provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-171Ar3

## Assessing Security Requirements for Controlled Unclassified Information

Ron Ross Victoria Pillitteri

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171Ar3

<!-- image -->

## NIST Special Publication

## NIST SP 800-171Ar3

## Assessing Security Requirements for Controlled Unclassified Information

Ron Ross Victoria Pillitteri Computer Security Division

Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-171Ar3

May 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at

Organizations are encouraged to review all draft publications during public comment periods and provide feedback https://csrc.nist.gov/publications.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does PBX Administrator’s Security Standards provide? (Part 5)

[Assistant] Use Networking Services Effectively | 3-17 | | Physically Protect All Equipment | 3-17 | | Security of Diskettes, Tapes, Backups and other Computer Related Equipment | 3-18 | | Ensure Physical Security of Shared Equipment | 3-19 | | Secure Building Cable Plant Access Points | 3-19 | | Apply PBX Security Measures to Key Telephone Systems | 3-20 | | Maintain Up-to-Date Records of Configuration | 3-20 | | Maintain Copies of Contractual Agreements | 3-21 | | Make End Users Aware of Their Responsibilities | 3-22 | | Summary of End User Responsibilities | 3-23 | | Report All Security Incidents | 3-24 | | Section 4: Future Concerns | | | Looking Toward the Future | 4-1 | | Common Channel Signaling System 7 (CCSS7) | 4-1 | | Appendix | | | Appendix: Terms and Definitions | A-1 | ## Section 1: FDIC Telephone Policy •?.-.